Remote access sample, please help with task.

[Patrick524]

Hello, please provide suggested new task details for config file based on the sample below.

Log Name: System
Source: RemoteAccess
Date: 11/9/2020 1:47:42 AM
Event ID: 20271
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer:
Description:
CoId={NA}: The user Administrator connected from 45.146.164.159 but failed an authentication attempt due to the following reason: The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server.
Event Xml:



20271
3
0
0x80000000000000

649418
System




{NA}
Administrator
45.146.164.159
The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server.
0x10
B3020000

[devnulli]

hi,
could you try to add this to the tasks
testtask.txt

in case it doesnt work, (i dont have such entries),

could you repost the xml in xml format pls, should look like that?

[Patrick524]

Here is the XML image requested.

Event Xml:



20271
3
0
0x80000000000000

700162
System
deleted



{NA}
11
87.251.67.129
The remote connection was denied because the user name and password combination you provided is not recognized, or the selected authentication protocol is not permitted on the remote access server.
0x10
B3020000

[Patrick524]

A basic regex works in the tester,
e.g. (\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})
but when adding to the config file, it's seeing something it doesn't like, won't start the service.

[devnulli]

hi patrick,

did you try to put the task (see above, testtast.txt) into your config?
if so, did it work?

greetings, Mike

[Patrick524]

Yes have tried, sorry but it's still not working.

[Patrick524]

[devnulli]

hi,

sorry for the delay (im a fresh father now ❤️ )

you could try the following regex:

Data\>(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\<\/Data

as in this sample

please note, when you copy the regex into the xml, the regex needs to be escaped, so in the xml, it should look like this:

Data\>(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\<\/Data

if you want to escape regexes for xml, you can also use this online tool

greetings,

mike

[shimuldn]

@devnulli Congratulations fresh father ❤️ ❤️

[devnulli]

@devnulli Congratulations fresh father ❤️ ❤️

Thx 😁 😁